What’s Vulnerable › Vulnerabilities

CVE-2026-10706: Exposure of Sensitive Information to an Unauthorized attacker

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-08 · updated 2026-10-25

Description

In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

Affected products

• Adalo No-Code App Builder App Builder: from 1 through 2

References

• https://kb.cert.org/vuls/id/849433

Get alerted when CVE-2026-10706 or the next vulnerability affects your stack